Resource provisioned using kubectl in container
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.What happened
A kubectl command was used to provision new resources, potentially to establish persistence or create unauthorized workloads.
Goal
Detect the use of kubectl commands inside a container to provision new resources.
Strategy
This detection triggers when kubectl is executed with specific arguments related to provisioning resources, such as creating a namespace and running a pod.
Triage and response
- Identify the purpose of the container using tags, such as the image and service tags.
- Determine the resources involved, such as new containers.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
Requires Agent version 7.27 or greater
